Attacking Insecure ELK Deployments

Introduction

Nowadays, we see a continuous increase of the adoption of the Elasticsearch Logstash Kibana (ELK) stack for security monitoring purposes. The functionalities of the ELK stack fit nicely the purpose of a SIEM; in fact, within few minutes it is possible to spin up a cluster and deploy the data collectors on the endpoints.

Considering the open source nature of the Elastic project and the presence of ingestors like Winlogbeat , its increase in popularity is not surprising.

Extending BloodHound

This series of posts was inspired by porterhau5’s work that can be found here: Extending BloodHound: Track and Visualize Your Compromise .

1. The Problem

In a standard Active Directory assessment, a fundamental phase is the analysis of Group Policy Objects (GPOs). Usually, this activity is aimed at identifying the following:

• Opportunities for lateral movement via misconfigurations of remote access policies and UAC¹;
• Misconfigurations that could allow further compromise, such as lack of SMB signing;
• Password policies;
• Privilege Assignment;
• Local group membership.

…and much more. The process of parsing GPOs is often tedious and very time consuming. Tools like Grouper2² can drastically reduce the required time, but the volume of the output is still quite considerable.